siwacruz[.]github[.]io

This domain, siwacruz.github.io, is flagged as an active high-risk phishing threat specializing in cryptocurrency wallet drainers. Analysis indicates the site is designed to impersonate legitimate crypto platforms, tricking users into connecting their wallets to malicious smart contracts. Once connected, these contracts automatically siphon funds without the victim's knowledge, often targeting popular blockchain networks such as Ethereum, Binance Smart Chain, and Polygon. The site leverages GitHub Pages for hosting, a tactic increasingly used by threat actors to exploit trusted infrastructure and evade traditional detection mechanisms. Users who interact with this domain risk immediate and irreversible financial loss, as transactions on blockchain networks are irreversible by design. Infrastructure analysis reveals several critical indicators confirming the malicious nature of this domain. The site resolves to the IP address 185.199.108.153, which is part of GitHub, Inc.'s hosting infrastructure located in the United States. Despite its appearance as a legitimate GitHub Pages site, the domain has been flagged by 14 out of 95 security vendors on VirusTotal, including detections for phishing, malicious scripts, and crypto-related fraud. The domain was created on April 08, 2026, a future date that suggests either a misconfiguration or an attempt to obscure its true registration timeline. It is currently registered through GitHub, Inc., and appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt (R12), provides a false sense of security, as encryption does not guarantee the legitimacy of the site's content. Users who have visited siwacruz.github.io or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any cryptocurrency wallets that may have been linked to the site by revoking permissions through wallet management tools such as Etherscan or BscScan, depending on the blockchain network involved. Next, scan the device used to access the site with updated antivirus software to detect and remove any malware or scripts that may have been downloaded. Monitor all linked wallets and financial accounts for unauthorized transactions, and report any suspicious activity to the relevant platform or exchange. If funds have already been lost, file a report with local law enforcement and relevant cybercrime units, providing all available transaction details. To prevent future incidents, enable hardware-based or multi-signature wallet protections and verify the authenticity of any site requesting wallet connections by cross-referencing official sources.